HR records when an employee leaves

When employment ends, distinguish disabling access from deleting records. The business may need payroll, pension, tax, claim and contractual information after the worker's account is closed, but it should not retain every personal file indefinitely.

Complete the operational handover

Record the termination date, final pay calculation, property returned and transfer of business responsibilities. Issue the required payroll documents and preserve the basis for deductions or outstanding payments. Acas explains final-pay documentation and the P45 requirement. ^[2]

Remove unnecessary access at the appropriate time while preserving business records and relevant evidence. Arrange a controlled handover of mailboxes and shared files rather than giving unrestricted access to personal material.

Apply retention by record type

Use the documented purpose and applicable legal requirements to set retention periods. ICO guidance requires personal data not to be kept longer than needed, with justified retention decisions. ^[1] A live dispute may require preservation of relevant records even where routine deletion would otherwise occur.

Record who can answer later reference or data requests. Reference wording may constrain the response; subject access remains relevant after departure. At the end of the retention period, delete or anonymise securely unless a documented reason requires continued retention.

Coordinate the departure date across operational teams Confirm the employment end date, last working day and any period of garden leave or continuing cooperation. Tell payroll, HR, IT and the manager which date matters for each task. A single leaver date can create errors if access ends before an authorised handover or benefits stop before the contractual end. Keep the reason for the arrangement and the person approving it. The offboarding process should reflect the actual departure terms rather than apply a default sequence that conflicts with notice or a settlement agreement.

List business responsibilities needing transfer, including customers, approvals, subscriptions and shared accounts. Assign a successor and arrange authorised access without sharing the departing employee's password. Record returned property and any item still outstanding. If personal material exists on a company device, use a controlled process to separate it from business information. Do not ask the employee to delete files indiscriminately where records may be needed for operations or a dispute. An orderly handover should preserve business continuity while respecting personal information and the relevant evidence requirements.

Preserve the final employment and payment record Reconcile wages, notice, holiday, expenses and deductions before issuing final payroll instructions. Retain the calculation and supporting agreements, not only the net amount paid. Acas explains final-pay records and the P45 requirement. [2] Keep any later correction connected to the original calculation. If a settlement controls payment or reference arrangements, make the necessary instructions available to the responsible staff while restricting access to the wider agreement. Closing the HR account should not make a future query impossible to answer from the records retained.

Identify ongoing obligations such as pension information, tax records, regulatory reporting or an agreed reference. Assign a contact for future requests and ensure the organisation can find the relevant agreement after the original manager leaves. A personal mailbox should not be the sole location of an undertaking the business must honour. Record the source and current version of approved reference wording. If the employee is involved in a live investigation or claim, coordinate the preservation decision before routine offboarding deletes or archives material beyond practical retrieval.

Distinguish access removal from retention decisions Disable unnecessary permissions at the appropriate time, including third-party systems and administrative accounts, but decide separately what data must remain. A deactivated account may contain relevant business records or evidence that needs controlled retention. Conversely, retaining a mailbox does not justify unrestricted access by the whole team. Identify the purpose, authorised users and handling of personal correspondence. The ICO explains that retention depends on need and applicable legal requirements rather than one universal data protection period. [1] Apply that principle to each record category and its actual purpose.

Use a documented schedule for payroll, contracts, health information and other records, with appropriate legal input. Different categories can have different required periods, including current holiday-record obligations. Do not keep every leaver file forever on the possibility that it might be useful, and do not delete all records immediately because the person asks to leave the organisation. Where a live dispute requires preservation, define the relevant material and review point. A targeted hold should remain understandable and be revisited when the reason for it changes or ends.

Make later access and correction requests manageable Ensure the responsible team can locate a former worker's records across systems using reliable identifiers. A subject access request can arise after departure, and the process should not depend on the person still having an employee login. Verify identity and authority proportionately and use a suitable communication route. If the former worker challenges a factual record, preserve the request and assessment. Accurate retention includes managing relevant corrections, not merely keeping an old copy untouched even after the organisation learns that a material entry was wrong.

At the scheduled review, check whether each continuing purpose remains valid and whether any preservation hold still applies. Delete or anonymise securely where the information is no longer needed, addressing backups and service-provider arrangements appropriately. Keep enough evidence of the retention decision and disposal process without recreating the personal data unnecessarily. If the business changes systems or closes, assign responsibility for records that must remain available. A completed leaver process should leave the business with controlled access, a usable employment history and clear reasons for what it retains, rather than either an indiscriminate archive or an avoidable evidential gap.